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Listing of Claims: 

1 . (Previously presented) A data network management system for identifying 
unauthorized access to a data network service, provided at a service node in a 
data network, by a user node in said data network, said service node having an 
agent and having means for maintaining a user access list, said user access list 
having at least one data network address corresponding to at least one user node 
in said data network, said system comprising: 

a data communication means for periodically polling said agent at said 
service node and for retrieving a user access list from said agent; 

a database for maintaining an authorized access list for said service node; 

and 

a data processing means for comparing said user access list to said 
authorized access list and for updating said authorized access list based on the 
user access list retrieved from said agent. 

2. (Previously presented) The data network management system as defined 
in claim 1 , wherein said agent is a Simple Network Management Protocol agent. 

3. (Previously presented) The data network management system as defined 
in claim 1, wherein said data communication means is a Simple Network 
Management Protocol communication means. 

4. (Previously presented) The data network management system as defined 
in claim 1 , further including means for installing said agent at said service node, 
said agent having means to communicate with said data communication means. 

5. (Previously presented) A method for identifying unauthorized access to a 
data network service, provided at a service node in a data network, by a user 
node in said data network, said service node having an agent and having means 
for maintaining a user access list, said user access list having at least one data 
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network address corresponding to at least one user node in said data network, 
said method comprising: 

a) periodically polling an agent and retrieving said user access list, for 
a given period of time, from said service node in said data network; 

b) comparing said user access list to an authorized access list; 

c) determining if an access to said service node was unauthorized 
based on comparing said user access list to the authorized access list; and 

d) if said access was not authorized, initiating a notification process; 
wherein said user access list identifies a plurality of accesses to said 

service node. 

6. (Previously presented) The method as defined in claim 5, further including 
updating said authorized access list based on said user access list retrieved from 
said service node. 

7. (Previously presented) The method as defined in claim 5, further including 
installing said agent at said user node, prior to periodically polling and retrieving 
said user access list. 

8. (Previously presented) The method as defined in claim 5, further including 
selecting said service node for identification based on a predetermined criteria, 
prior to retrieving said user access list. 

9. (Previously presented) The method as defined in claim 5, wherein said 
notification process comprises notifying a Network Operations Console. 

10. (Previously presented) The method as defined in claim 5, wherein a) 
through c) are repeated, and wherein said user node is selected from one of a 
plurality of user nodes in said data network. 
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11. (Previously presented) The method as defined in claim 5, wherein a) 
through d) are repeated, and wherein said user node is selected from one of a 
plurality of user nodes in said data network. 

12. (Previously presented) The method as defined in claim 5, wherein said 
agent is a Simple Network Management Protocol agent. 

13. (Previously presented) A computer-readable medium for identifying 
unauthorized access to a data network service, provided at a service node in a 
data network, by a user node in said data network, said service node having an 
agent and having means for maintaining a user access list, said user access list 
having at least one data network address corresponding to at least one user node 
in said data network, and said medium having stored thereon, computer-readable 
and computer-executable instructions which, when executed by a processor, 
cause said processor to perform steps comprising: 

a) periodically polling an agent and retrieving said user access list, for 
a given period of time, from said service node in a data network; 

b) comparing said user access list to an authorized access list; 

c) determining if an access to said data network service was 
authorized based on said comparison step b); 

d) if determined that said access was unauthorized, initiating a 
notification process. 

14. (Previously presented) The computer-readable medium as defined in 
claim 13, further containing computer-readable and computer-executable 
instructions which perform a step of updating said authorized access list based on 
user access information. 

15. (Previously presented) The computer-readable medium as defined in 
claim 13, further containing computer-readable and computer-executable 
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instructions which perform a step of installing said agent at said user node, prior 
to retrieving said user access list in step a). 

16. (Previously presented) The computer-readable medium as defined in 
claim 13, further containing computer-readable and computer-executable 
instructions wherein said steps a) through c) are repeated, and wherein said user 
node is selected from one of a plurality of user nodes in said data network. 

17. (Previously presented) The computer-readable medium as defined in 
claim 13, wherein said agent is a Simple Network Management Protocol agent. 

1 8. (Previously presented) A computer for use in a data network for identifying 
unauthorized access to a data network service, provided at a service node in a 
data network, by a user node in said data network, said service node having an 
agent and having means for maintaining a user access list, said user access list 
having at least one data network address corresponding to at least one user node 
in said data network; said computer comprising: 

means for storing an authorized access list for said service node; 
a central processing unit; 

data communication means for periodically polling said agent at said 
service node and retrieving a user access list from said agent; and 

data processing means for comparing said retrieved user access list to 
said authorized access list and for updating said authorized access list based on 
the user access list retrieved from said agent. 

19. (Previously presented) The data network as defined in claim 1, wherein 
said authorized access list is a common authorized user access list that includes 
a range of user nodes for comparing to said user access list to determine if said 
user access list is a subset of said common authorization access list. 
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20. (Previously presented) The data network management system of claim 1 
wherein said user access list identifies a plurality of accesses to said service 
node. 
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